Re: Snort running inline but not functioning as IPS

["Joel Esler (jesler)" <jesler () cisco com>]

Are you sure you have the blacklist preprocessor rule still turned on?

Sent from my iPhone

> On Jan 23, 2016, at 7:03 PM, Robin Kipp <mlists () robin-kipp net> wrote:
>
> Hi Joel,
>
> > Am 22.01.2016 um 14:41 schrieb Joel Esler (jesler) <jesler () cisco com>:
> >
> >
> > There are certain categories that might be completely drop worthy, like exploit-kit and malware-cnc.  But otherwise, 
> > I’d go with the policy method.
>
> OK. So, I just basically got rid of the EmergingThreatsPro rules and set my policy to ‚balanced‘. From pulledpork’s 
> output, I can see that it recognized the policy setting and I guess it set the rules accordingly.
> However, at this point Snort no longer produces alerts. Using barnyard2, I noticed that no more alerts are being 
> added to the database, also if I run Snort with the -A console option will not result in alerts being written to the 
> console. Thanks to the stats, I can see that Snort is in fact capturing and analyzing traffic and I’ve tried to 
> trigger alerts by connecting to blacklisted IPs while Snort was running.
> So, am I missing something, or will Snort simply not log alerts when rules are being ‚dropped‘? I couldn’t possibly 
> imagine that this is the case, but other than changing the policy there isn’t really anything that I’ve changed…
> Robin

------------------------------------------------------------------------------
Site24x7 APM Insight: Get Deep Visibility into Application Performance
APM + Mobile APM + RUM: Monitor 3 App instances at just $35/Month
Monitor end-to-end web transactions and take corrective actions now
Troubleshoot faster and improve end-user experience. Signup Now!
http://pubads.g.doubleclick.net/gampad/clk?id=267308311&iu=/4140
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!